A few things about passwords in 2017

1. Admins: Forget about stupid password rules and focus on the length

The idea is to focus on the one understandable, simple, practical, works-in-real-life-in-every-situation rule: length. Users can enter (almost) anything, in proper Unicode, provided it’s long enough. That’s the one rule to bind them all that we need to teach users: length!
Jeff Atwood – https://blog.codinghorror.com/password-rules-are-bullshit/

2. Admins: Stop asking for periodic password reset *

This applies mostly to large organisations, who are asking the users to memorize a new password periodically.
This is not practical and what will usually happen is that the users will slightly alter the previous password. For instance, some users will increment a number at the end of their password (ex. the number of the year/month). So this measure is more likely to reduce the overall security rather than improve it.

Research suggests frequent mandatory expiration inconveniences and annoys users without as much security benefit as previously thought, and may even cause some users to behave less securely. Encouraging users to make the effort to create a strong password that they will be able to use for a long time may be a better approach for many organizations, especially when combined with slow hash functions, well-chosen salt, limiting login attempts, and password length and complexity requirements. And the best choice – particularly if your enterprise maintains sensitive data – may be to implement multi-factor authentication.
Federal Trade Commission – Time to rethink mandatory password changes

3. Admins: Allow pasting passwords

Just leave the password managers do their job.

Preventing the copying and pasting of passwords does nothing in terms of preventing brute force attacks. It also breaks usability in a number of key ways, not to mention breaking password managers. Essentially, it forces users to make up easy passwords so that they can type them without making mistakes. Thus allowing easy access via brute force attacks.
Philip Norton’s comment on The “Cobra Effect” that is disabling paste on password fields by Troy Hunt

4. Admins: implement multi-step verification, but avoid SMS

The idea with multi-factor authentication is to test someone’s identity based on something they know (like a password) and something they have (like their phone). The problem with using SMS is the fact that they are sent to the user device. And this means that they can be intercepted. It’s recommended to replace that with a system generating one-time passwords (OTP) on the user device:

Adding a layer of SMS-based verification to your login process is certainly better than relying on a password alone. But two-factor authentication using SMS text messages isn’t technically two-factor at all.
Better tools like Google Authenticator or an RSA token prove that possession, by generating a unique code that matches one generated on a web service’s server. It’s a test that, thanks to some clever crypto tricks, doesn’t involve any communication between the two computers. That’s far more effective than sending a text message with a one-time code to someone’s phone. It’s less convenient, though, which may be why it’s also less commonplace.
“SMS has turned that ‘something you have’ into ‘something they sent you,’. If that transaction is happening, it can be intercepted. And that means you’re potentially at some level of risk.”
Andy Greenberg, WIRED – So Hey You Should Stop Using Texts for Two-Factor Authentication